How Revvye handles data.

Revvye is a revenue-leak diagnostic for any business with a website. We scan public website surfaces, score the leaks we find, and offer paid reports and services on top of those findings. This privacy policy describes how we treat personal information across all free and paid Revvye products.

Privacy questions, data-rights requests, and policy concerns: privacy@revvye.com or support@revvye.com. Postal mail: [MAILING_ADDRESS].

Contract performance. Account data, submitted scan URLs, and payment data are processed because we need them to provide the service you signed up for: running scans, returning results, and charging for paid unlocks.

Legitimate interest. Usage telemetry, error reports, and security logs are processed to keep the platform reliable, prevent abuse, and improve the product. We try to keep this minimal and we redact obvious PII before sending data to Sentry.

Consent. Marketing emails, newsletters, and any non-transactional communications are sent only with your consent. You can withdraw that consent at any time using the unsubscribe link or by emailing privacy@revvye.com.

Legal obligation. We retain financial records to comply with tax, accounting, and dispute-resolution obligations.

• Supabase— primary database, authentication, and file storage. Stores your account record, scan inputs, scan results, paid-unlock records, and any uploaded artifacts. Data residency: US region by default.
• Stripe— payment processing for paid reports and services. PCI compliance is handled by Stripe; we never receive full card data. Stripe stores customer records, payment methods, charges, and refund history.
• Cloudflare— hosting, DNS, edge caching, and the worker infrastructure that runs the scan engine. Touches request metadata (IP, user agent, request path) for delivery and protection.
• Sentry— error monitoring and performance tracing. PII redaction is enabled (SEND_DEFAULT_PII=false). We send stack traces and limited request context, not user input bodies.
• PostHog— product analytics. Captures anonymized session and event data. Cookieless mode is used where applicable; otherwise a session cookie is set. You can opt out of analytics through your browser’s Do Not Track signal or by requesting suppression at privacy@revvye.com.

The Revvye scan worker runs on Cloudflare and writes results into Supabase. No scan data is shared with third parties outside this list.

If your website was scanned by a Revvye user and you would like to request the scan record or its deletion, contact privacy@revvye.com. Revvye scans only public pages, but you have the right to ask for the record we hold.

• Account data— kept while your account is active, plus 90 days after a deletion request. After that, only records we’re legally required to retain remain.
• Scan data and public-page artifacts— 12 months from the date of the scan, or until you request deletion, whichever comes first. Scans tied to paid orders are retained for the full 12 months for support and dispute purposes.
• Payment records— 7 years, as required by US tax and accounting rules. This covers invoices, charges, and refund history; no card data is held by us.
• Analytics— 12 months in PostHog, then aggregated or deleted.
• Error reports— 30 days in Sentry, then purged.
• Communications— support emails are retained for 24 months for follow-up context.

We may retain anonymized, aggregated data (no identifiers, no IP, no URLs) longer to improve methodology and benchmark outputs. Aggregate data cannot be re-linked to you.

You may request to (a) access the data we hold, (b) correct inaccurate data, (c) delete your data, (d) export a portable copy, (e) object to a particular processing activity, or (f) withdraw consent for marketing communications. Email privacy@revvye.com with the request and we will verify your identity before acting.

Some retention obligations (financial records, fraud prevention, security logs) may require us to keep limited records even after a deletion request. We will tell you which records were retained and why.

EU and UK residents. The lawful bases for processing your personal data are listed in section 3 (contract performance, legitimate interest, consent, legal obligation). You have the right to lodge a complaint with your local supervisory authority. International transfers from the EU/UK to the United States rely on Standard Contractual Clauses where applicable.

California residents. We do not sell personal information. We do not share personal information for cross-context behavioral advertising. Under the California Consumer Privacy Act and the California Privacy Rights Act you have the right to know what we collect, to delete it, to correct it, to limit the use of sensitive personal information, and to not be retaliated against for exercising those rights. To exercise these rights, contact privacy@revvye.com.

Functional cookies are set by Supabase Auth (session token) and Cloudflare (security, load balancing). These are required for the site to work.

Analytics cookies are set by PostHog to track session events. We use cookieless mode where it is sufficient. You can disable analytics by enabling Do Not Track in your browser or by emailing privacy@revvye.com to be excluded from capture.

Stripe cookies are set inside the Stripe checkout iframe for fraud detection and to keep the checkout session active. These are governed by Stripe’s policies.

All traffic to Revvye uses TLS in transit. The database underneath the platform uses encryption at rest provided by Supabase. Access to production systems is restricted to a small number of credentialed operators and audited.

No system is unbreakable. If you become aware of a security issue, contact security@revvye.com. If a breach affects your data, we will notify you and the relevant authorities within the windows our jurisdiction requires.

Revvye is not intended for children under 13 (United States) or under 16 (European Union and United Kingdom). We do not knowingly collect personal data from children. If you believe a child has used Revvye, contact privacy@revvye.com and we will delete the record.

When we make material changes to this policy we will update the “Last reviewed” date at the top of the page and notify account holders by email or by a banner on the site at least 30 days before the change takes effect for existing data. Continued use of Revvye after the effective date means the updated policy applies going forward.

Privacy and data-rights requests: privacy@revvye.com.

General support and refund requests: support@revvye.com.

Postal mail: [COMPANY_LEGAL_NAME], [MAILING_ADDRESS].